Signature Detail

SCAN: Core Impact Internet Explorer JPEG GDI Exploit

This signature detects attempts to exploit the Microsoft JPEG GDI Core Impact's vulnerability mentioned in Microsoft Vulnerability Notice MS04-028. A successful attack can create a denial-of-service (DoS) condition or execute arbitrary code with user privileges.

Extended Description

Microsoft (Graphics Device Interface) GDI+ JPEG handler is reported prone to an integer underflow vulnerability when handling JPEG format images. This issue presents itself due to a lack of sufficient sanity checks performed on certain JPEG data before this data employed as a bounds value for a memory copy operation. A specially crafted JPEG image may trigger this vulnerability and result in the execution of arbitrary attacker-supplied code. Code execution would occur in the context of the user who is running the vulnerable software. **Update: This issue is similar in nature to BID 1503, discovered by Solar Designer. ** An exploit that opens a command shell on the local vulnerable system as soon as the image is viewed has been released. Symantec has confirmed that this exploit code is functional. It is important to note that this exploit could potentially be modified to execute other code on the system. Administrators should remain vigilant and patch all vulnerable systems.

Affected Products

• Avaya DefinityOne Media Servers
• Avaya IP600 Media Servers
• Avaya S3400 Message Application Server
• Avaya S8100 Media Servers
• Business Objects Crystal Enterprise 10.0.0
• Business Objects Crystal Enterprise 9.0.0
• Business Objects Crystal Reports 10.0.0
• Business Objects Crystal Reports 9.0.0
• Microsoft Digital Image Pro 7.0
• Microsoft Digital Image Pro 9.0
• Microsoft Digital Image Suite 9.0
• Microsoft Excel 2002 SP1
• Microsoft Excel 2002 SP2
• Microsoft Excel 2002 SP3
• Microsoft Excel 2002
• Microsoft Excel 2003
• Microsoft FrontPage 2002 SP1
• Microsoft FrontPage 2002 SP3
• Microsoft FrontPage 2002
• Microsoft FrontPage 2003
• Microsoft Greetings 2002
• Microsoft InfoPath 2003
• Microsoft Internet Explorer 6.0 SP1
• Microsoft MSN Messenger Service 9.0
• Microsoft .NET Framework 1.0 SP2
• Microsoft .NET Framework 1.1
• Microsoft .NET Framework SDK 1.0
• Microsoft .NET Framework SDK 1.0 SP1
• Microsoft .NET Framework SDK 1.0 SP2
• Microsoft Office 2003
• Microsoft Office XP SP1
• Microsoft Office XP SP2
• Microsoft Office XP SP3
• Microsoft Office XP
• Microsoft OneNote 2003
• Microsoft Outlook 2002 SP1
• Microsoft Outlook 2002 SP2
• Microsoft Outlook 2002 SP3
• Microsoft Outlook 2002
• Microsoft Outlook 2003
• Microsoft Picture It! 7.0
• Microsoft Picture It! 9.0
• Microsoft Picture It! 2002
• Microsoft Picture It! Library
• Microsoft Platform SDK Redistributable: GDI+
• Microsoft PowerPoint 2002 SP1
• Microsoft PowerPoint 2002 SP2
• Microsoft PowerPoint 2002 SP3
• Microsoft PowerPoint 2002
• Microsoft PowerPoint 2003
• Microsoft Producer for Microsoft Office PowerPoint
• Microsoft Project 2002 SP1
• Microsoft Project 2002
• Microsoft Project 2003
• Microsoft Publisher 2002 SP3
• Microsoft Publisher 2002
• Microsoft Publisher 2003
• Microsoft Visio 2002 SP1
• Microsoft Visio 2002 SP2
• Microsoft Visio 2002
• Microsoft Visio 2002 Professional SP2
• Microsoft Visio 2002 Standard SP2
• Microsoft Visio 2003
• Microsoft Visio 2003 Professional
• Microsoft Visio 2003 Standard
• Microsoft Visual Basic .NET Standard 2002
• Microsoft Visual Basic .NET Standard 2003
• Microsoft Visual C# .NET Standard 2002
• Microsoft Visual C++ .NET Standard 2002
• Microsoft Visual C# .NET Standard 2003
• Microsoft Visual C++ .NET Standard 2003
• Microsoft Visual FoxPro 8.0
• Microsoft Visual FoxPro Runtime Library 8.0
• Microsoft Visual J# .NET Standard 2003
• Microsoft Visual Studio .NET 2002
• Microsoft Visual Studio .NET 2003
• Microsoft Windows Messenger 5.0
• Microsoft Windows Server 2003 Datacenter Edition
• Microsoft Windows Server 2003 Datacenter Edition Itanium
• Microsoft Windows Server 2003 Enterprise Edition
• Microsoft Windows Server 2003 Enterprise Edition Itanium
• Microsoft Windows Server 2003 Standard Edition
• Microsoft Windows Server 2003 Web Edition
• Microsoft Windows XP 64-bit Edition SP1
• Microsoft Windows XP 64-bit Edition
• Microsoft Windows XP 64-bit Edition Version 2003
• Microsoft Windows XP Home SP1
• Microsoft Windows XP Home
• Microsoft Windows XP Professional SP1
• Microsoft Windows XP Professional
• Microsoft Word 2002 SP1
• Microsoft Word 2002 SP2
• Microsoft Word 2002 SP3
• Microsoft Word 2002
• Microsoft Word 2003

References

• BugTraq: 11173
• CVE: CVE-2004-0200
• URL: http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx
• URL: http://www.kb.cert.org/vuls/id/297462